Import OpenSSL 3.5.7 (previous was 3.5.6)
OpenSSL 3.5.7 is a security patch release. The most severe CVE fixed
in this release is High.
This release incorporates the following bug fixes and mitigations:
Fixed heap use-after-free in PKCS7_verify().
(CVE-2026-45447)
Fixed CMS AuthEnvelopedData processing may accept forged messages.
(CVE-2026-34182)
Fixed unbounded memory growth in the QUIC PATH_CHALLENGE handler.
(CVE-2026-34183)
Fixed NULL pointer dereference in QUIC server initial packet handling.
(CVE-2026-42764)
[35 lines not shown]
boehm-gc: update to 8.2.12.
== [8.2.12] 2026-02-05 ==
* Do not prevent shared builds on OpenBSD/alpha
* Eliminate 'argument unused' gcc warning in push_all_stack_partially_eager
* Eliminate 'assign long to void*' gcc warning in get_stack_base on Serenity
* Eliminate 'format expects argument of type' gcc warnings in dump_meminfo
* Eliminate 'GC_push_all_stack not used' gcc warning if fix-up pointers
* Eliminate 'GC_remove_roots_subregion not used' gcc warning on Solaris
* Eliminate 'unused parameter' clang warnings in GC_darwin_sigbus
* Fix 'KERN_PROTECTION_FAILURE while world is stopped' error on MacOS X
* Fix 'MA_FETCHOP undeclared' gcc error if USE_PROC_FOR_LIBRARIES on Solaris
* Fix 'PIOCNMAP undeclared' gcc error if USE_PROC_FOR_LIBRARIES on Solaris
* Fix 'reserved' argument handling in GC_DllMain
* Fix 'undefined errno' compiler error in strdup/strndup on WinCE
* Fix a cycle in NORMAL freelist if malloc is redirected on Linux
* Fix assertion in GC_wait_for_reclaim if DllMain-based thread registration
* Fix code defect of LOCK/UNLOCK in separate 'if' in GC_generic_malloc_many
[218 lines not shown]
dialog: update to 1.3.20260107.
2026/01/07
+ modify package/debian/* to work with Debian 13+.
+ modify run_test.sh to set LD_LIBRARY_PATH in case "make check" is
used on a system where dialog's shared library was not installed.
+ improve gen-pkgconfig.in by widening the filter for "-z" options.
+ improve layout of menu and checklist/radiolist widgets (report by
Mike Castle).
+ add a limit-check in the tailbox widget.
+ correct length of input-fields in form widget (report by Mike Castle).
2025/12/23
+ correct a typo for aspect ratio in files written by --create-rc
(report by Mike Castle).
+ improve manpage description of --hline (report by Mike Castle).
+ update configure script macros for cross-compatibility.
+ added kab.po from
https://translationproject.org/latest/dialog/
[31 lines not shown]
desktop-file-utils: update to 0.28.
============
Version 0.28
============
common
- Increase GLib requirement to 2.26 (Corentin Noël).
- Fix install failing on second run (Raziel Anarki).
- Fix use of deprecated Meson feature resulting in a warning (Raziel
Anarki).
desktop-file-validate
- Allow groups with the same name as interfaces in Implements (Corentin
Noël).
- Add support for the COSMIC environment (Ryan Brue).
filezilla: update to 3.70.6.
3.70.6 (2026-06-04)
+ SFTP: Added compatibility flag to Site Manager to ignore invalid bits in file attributes flags received from non-compliant servers
- SFTP: Updated to fzssh 1.3.0
- Updated to libfilezilla 0.56.1
- Removed autodetection of FTP server type governing the remote path syntax. Exotic server types now need to be set explicitly on the advanced page in the Site Manager
libfilezilla: update to 0.56.1.
0.56.1 (2026-06-04)
- macOS: Fix fz::socket::connect() failing after bind()
- Creation flag validation and normalization for fz::file
0.56.0 (2026-05-27)
+ event_loop timers are now processed in a round-robin fashion if there are multiple expired timers
+ Added shared_value::use_count
- HTTP client: Fixed handling of 1yz responses
- fz::socket::connect now returns early on bind failure
- Minor fixes to socket classes
fzssh: update to 1.3.0.
1.3.0 (2026-05-27)
+ SFTP: Added compatibility flag to ignore unknown bits in flags field of File Attributes
- Added extra padding to SSH_MSG_USERAUTH requests to obfuscate the combined length of username and password
- Fixed some issues when importing malformed private keys
- Improved heuristic to decide on log level if an SSH connection unexpectedly closes
- Diffie-Hellman Group Exchange: Check that modulus of received group is a safe prime and that the subgroup is of the correct order
- Added additional checks for trailing data in incoming packets
entr: update to 5.8.
== 5.8: March 2, 2026
- MacOS: set open_max limit using MAXFILESPERPROC
- Add usage hint and '-h' flag to display option summary
- Add return value checks for malloc(3) and pipe(2)
- Make signal number configurable with ENTR_RESTART_SIGNAL
- Monitor symlinks on Linux and MacOS
- Avoid expanding filenames using realpath(3)
- Linux: return correct status if poll(2) is interrupted
- Always accept directories as input, making '-d' flag optional
fig2dev: update to 3.2.9a.
===============================================================================
Version 3.2
===============================================================================
Patchlevel 9a (Dec 2024)
NEW FEATURES:
o Specify pdf minor version with option -Y.
o Specify width (-Z <wid>w) or height (-Z <height>h) of figure.
BUGS FIXED:
Ticket numbers refer to https://sourceforge.net/p/mcj/tickets/#.
o Correctly read from a pipe, ticket #156.
o Fix behavior of option -F for e(e)pic and latex outputs, ticket #157.
o Compounds containing ascii-only text would disable utf-8 output, #158.
o Option --enable-versioning works in out-of-tree builds.
o Correct links to embedded image files in svg output.
o Correct font size in svg output, ticket #176.
[15 lines not shown]
gnumeric: update to 1.12.61.
Gnumeric 1.12.61
Morten:
* Up gtk+ requirement to 3.20. Still ancient.
* Audit code with Gemini AI.
* Plug leaks.
* Make tests run in parallel.
* Refactor analysis tools to be GObject-based.
* Fix sampling tool gui in the periodic case.
* Fix fill-series tool problems with dates.
* Fix chi-square tool problems with labels.
* Add basic testing of most analysis tools.
* Disable excelplugins (unrelated to xls/xlsx files).
* Fix gui crash [#857]
* Introspection fixes.
* Test suite enhancements
* Preserve cvs-to-cvs and cvs-to-txt line endings.
[18 lines not shown]
goffice0.10: update to 0.10.61.
goffice 0.10.61:
Morten:
* Up gtk+ requirement to 3.20. Still ancient.
* Fix regression error reporting problems.
* Introspection fixes.
* Import go_reduce_pi from Gnumeric.
* Test improvements.
* Plug leaks.
* Fix problems with go_string_new_len.
* Fix problem with arc canvas item.
* Fix various issued with text canvas item.
